[clamav-users] Heuristics.Phishing.Email.SpoofedDomain...

[G.W. Haywood]

Hi there,

On Thu, 1 Apr 2021, eric-list at truenet.com wrote:

> Just a heads up.  I noticed a bunch of American Express Statements in our
> quarantine.
> My guess is because they are using m.amex and go.amex links in the emails.
>
> DKIM and SPF pass so these definitely seem to be legit AMEX emails.
> From address is "American Express" <AmericanExpress at welcome.aexp.com>

Name(s) of the signature(s) detected?

-- 

73,
Ged.